Cloud Security Engineer

Designation: Cloud Infrastructure Security Engineer
Preferred Experience: 5+ Years
Job Summary
We are looking for an experienced Senior Cloud Security Engineer with strong expertise in AWS infrastructure security, Kubernetes (EKS), Infrastructure as Code (Terraform), and security compliance automation. The ideal candidate will be responsible for securing production cloud environments, implementing security controls aligned with FedRAMP Moderate and NIST SP 800-53 requirements, and supporting continuous compliance and authorization activities.
The candidate will play a key role in strengthening cloud security posture, automating Key Security Indicator (KSI) validation, implementing FIPS-validated cryptography, managing vulnerabilities, and building resilient, secure, and auditable cloud infrastructure. This role requires hands-on experience with regulated cloud environments, strong ownership, and the ability to work independently in a small engineering team.
Key responsibilities
Harden AWS and EKS. Apply CIS benchmarks for AWS and EKS; enforce Kubernetes network policies; give each workload its own IAM role (EKS Pod Identity / IRSA); harden RDS, DocumentDB, MSK (Kafka), and ElastiCache.
Introduce infrastructure as code. Bring the live environment under Terraform safely, including importing existing production resources, with drift detection and pipeline-only changes.
Set up compliance and security tooling. AWS Config conformance packs, Security Hub, Inspector, GuardDuty, CloudTrail, and centralised, tamper-resistant logging feeding a SIEM.
Automate KSI validation. Build scripts and pipelines that continuously check KSIs and produce machine-readable (JSON) evidence for the FedRAMP 20x package.
Tighten identity and access. Least-privilege IAM, just-in-time admin access, phishing-resistant MFA, and moving secrets into AWS Secrets Manager with automatic rotation.
Implement FIPS-validated cryptography. Inventory cryptographic modules; use FIPS 140-3 validated modules in node images, container images and service-to-service mTLS (FIPS-capable service mesh).
Run vulnerability management. Set up image, host, and dependency scanning, and a triage process that meets the 2026 FedRAMP vulnerability rules (VDR/VER) and remediation deadlines; drive patching.
Build recovery capability. Backups aligned to RTO/RPO, failover runbooks, and a regional failover test.
Support the assessment. Work with the client's FedRAMP assessor during the March 2027 pre-assessment and any follow-on certification audit; fix findings quickly.
Hand over and sustain. Document technical changes, keep them reproducible, and set up continuous monitoring that the small in-house team can run day to day.
Must-have skills and experience
5+ years in cloud infrastructure, DevOps or cloud security engineering, with at least 4 years of hands-on experience in AWS production environments.
Direct, hands-on experience taking a system through FedRAMP Moderate (or Class C), DoD IL4/5, or a comparable NIST 800- 53-based authorization.
Strong AWS security services: IAM, Organizations/SCPs, KMS, Secrets Manager, Config, Security Hub, Inspector, GuardDuty, CloudTrail, VPC design.
Production Kubernetes on Amazon EKS: CIS hardening, network policies, pod-level IAM, admission controls.
Terraform at production scale, including importing existing live resources without downtime.
Practical FIPS 140-2/140-3 experience: FIPS-mode hosts, FIPS container images, FIPS-validated TLS.
Vulnerability management: end-to-end scanning, risk-based triage, patching to deadlines.
Scripting for automation (Python, Bash, or Go) and CI/CD pipelines (GitHub Actions, GitLab CI, or similar).
Comfortable working alone in a small team: self-directed, careful with live production, and clear in communicating risk.
Nice to have
Familiarity with FedRAMP 20x, Key Security Indicators, and machine-readable (OSCAL/JSON) compliance evidence.
Service mesh with mTLS (Istio, Linkerd), ideally a FIPS build.
SIEM experience (Splunk, Sentinel, Elastic, Datadog, or similar).
Managed data services security: RDS, DocumentDB, MSK (Kafka), ElastiCache, including cross-region replication.
Policy-as-code (OPA/Gatekeeper, Kyverno, Checkov, tfsec).
Regulated life-sciences or healthcare background (HIPAA, GxP, FDA 21 CFR Part 11).
Certifications: AWS Certified Security – Specialty, CKS (Certified Kubernetes Security Specialist), HashiCorp Terraform Associate, CISSP or CCSP.
Company Overview:
Aventior is a leading provider of innovative, end-to-end technology solutions, empowering businesses across diverse industries to solve complex challenges and accelerate growth. We harness the power of cutting-edge technologies such as artificial intelligence (AI), machine learning (ML), MLOps, and DevOps to build scalable, future-ready solutions that drive measurable business outcomes.
Our expertise extends across the entire data lifecycle. We offer comprehensive data development and management services, including cloud data architecture, universal data models, Data Transformation & ETL, data lakes, user management, Analytics & visualization, and automated data capture for unstructured and semi-structured sources such as scanned documents. These capabilities enable organizations to unlock the full value of their data and make faster, more informed decisions.
At Aventior, our strength lies in combining deep industry expertise with advanced technical capabilities. Our teams work closely with clients to design and deliver tailored solutions that align with their unique business needs—whether it’s optimizing operations, enhancing customer experiences, or driving strategic decision-making.
We bring a holistic, cross-industry perspective to every engagement, supported by a strong foundation in design, implementation, innovation, migration, and ongoing support. With a global delivery model, a multi-country presence, and a team of highly skilled professionals, Aventior is well-positioned to deliver consistent, high-quality outcomes at scale.

Work arrangement
Yes